github-issue-repro-and-fix

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The workflow’s “Gather the issue context” step ingests outsider-authored GitHub issue and comment text at runtime via gh issue view <number> --json title,body,comments,... (or via the GitHub web page when gh isn’t available), which is free-form text written by non-operating users.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs using gh (e.g., "gh issue view" and "gh search ... --repo TanStack/table") to fetch live GitHub issue/PR content from GitHub (via api.github.com / https://github.com/TanStack/table) at runtime, and that fetched content would be injected into the agent context and directly control prompts.